[rocqua]

This is a back-door, since the public key will give you full access to plaintext.

Moreover, how do you audit whether the second cipher-text exists, and whether the second cipher-text actually decrypts to the same plain-text as the first?

There are plausible schemes for creating a common second actor that can access communication with a warrant. But they aren't this simple, and they tend to come with large complexity downsides.